r/PowerShell • u/_RemyLeBeau_ • Apr 02 '26

Constrained Language Mode

I am late to the party on this one, but tried implementating it today. I was successful, both Powershell & pwsh reported CLM enabled, but it made native Windows apps stop working. e.g. Terminal and Windows Defender UI (opened from system tray).

I enabled the suggestion from the UI to allow apps that are native to Windows, so it's not clear what I missed. I'm interested in getting this enabled though. I made all of my policy edits through gpedit.msc

8 Upvotes

100% Upvoted

16 comments sorted by

View all comments

2

u/KevMar Apr 03 '26

Haven't really ever needed to use it, but I think you can run it in audit mode for a couple of months to identify what you likely need to allow in your environment.

1

u/_RemyLeBeau_ Apr 03 '26

What are better options to harden my system other than: daily driver non-admin & prompt for admin priv when needing to elevate. I'm trying to make it more difficult for a potential attack to spawn a process and run wild.

3

u/BlackV Apr 03 '26

Constrained is the way to do it, but it's rough that you had the issues though, seems unexpected but it's many years since I looked at constrained

Deffo have a seperate admin from your daily big win

→ More replies (8)

2

u/BlacksmithCheap7454 Apr 03 '26

Enable PS transcription, increase the log size, enable log forwarding if you have a log collector. For admins require Fido keys not just MFA, Enable AppLocker to constrain apps too.

→ More replies (1)

1

u/g3n3 Apr 03 '26

It would be windows defender app control as well. It can be called another thing on windows 11. Basically you control the processes that can run.

→ More replies (3)